BUDGET-AWARE ADAPTIVE ADVERSARIAL PATCHES FOR BLACK-BOX OBJECT DETECTION Pedram MohajerAnsari, Amir Salarpour, David Fernandez, Mert D. Pesé
arXiv:2606.18318v1 [cs.CV] 16 Jun 2026
School of Computing, Clemson University, USA {pmohaje, asalarp, dferna3, mpese}@clemson.edu ABSTRACT Adversarial patches pose a practical threat to modern object detectors. Prior work shows vulnerability, but three gaps limit actionable insight: (i) few score-based black-box attacks jointly optimize patch location, texture, and size under tight query budgets; (ii) success is rarely tied to the patch’s visual footprint; and (iii) evaluations often conflate EOT robustness with plain-view suppression. We present PATCH BAN DIT , a query-efficient, budget-adaptive black-box attack that couples a lightweight Contextual Thompson-Sampling placer with NES-style pixel updates, growing the patch only when progress stalls. Reporting is anchored by a strict plain-image suppression test; EOT is audited but never used as a substitute for success, and optional appearance/printability weights expose strength–visibility trade-offs. Across YOLOv5, Faster R-CNN, and YOLOS, PATCH BANDIT achieves strong suppression on CNN-based detectors and substantial suppression on the transformer-based detector, using compact patches and exposing clear query–footprint trade-offs relative to fixed-size and heuristic baselines. A print–capture pilot further shows transfer across unseen physical objects and viewpoints. Code is available at https://github.com/pedram-mohaj er/PatchBandit. Index Terms— Adversarial patch, Black-box attack, Query-efficient optimization, Object detection 1. INTRODUCTION In critical applications such as autonomous driving, robotics, and surveillance, computer vision systems increasingly depend on object detectors to detect and classify objects within a scene. These detectors span one-stage CNN architectures such as YOLO [1], two-stage CNN detectors such as Faster RCNN [2], and transformer-based detectors such as YOLOS [3]. Like image classifiers, these detectors are vulnerable to adversarial perturbations—small, crafted input changes that induce incorrect predictions [4]. Among the most practical threats are adversarial patches [5]: localized patterns that can be printed and placed in the environment so cameras repeatedly capture them and downstream models are consistently misled. Because a single patch can be reused, scaled, and repositioned across
(a) Clean physical
(b) Patched physical
(c) Clean digital
(d) Patched digital
Fig. 1: A 160 px physical patch flips the top YOLO prediction from bicycle (0.95) to motorbike (0.36); a 60 px digital patch flips a clean boat (0.91) to cat (0.92).
scenes, patch attacks align naturally with physical-world threat scenarios. However, existing patch methods leave a gap between what is demonstrated in controlled settings and what is feasible against deployed detectors. Prior work includes universal white-box patches [5, 6], physical demonstrations [7], and query-efficient black-box attacks on classifiers [8, 9], yet many real detectors are score-only black boxes [10], which limits access to gradients and internal signals. This challenge applies across detector architectures, from CNN-based detectors to transformer-based models such as YOLOS. Under this interface, three issues remain. First, attackers must jointly decide where to place a patch and what texture to optimize under a tight query budget, but many approaches fix location, assume loose budgets, or rely on surrogate gradients [11]. Second, success is rarely reported as a function of patch area or appearance cost, despite the practical importance of visual footprint [12]. Third, Expectation-overTransformation (EOT) training is common [13], but EOT-
averaged progress can diverge from suppression on the plain camera view encountered in deployment [14], motivating evaluation that separates plain-view success from robustness across transforms. We present PATCH BANDIT, a score-based black-box adversarial patch attack designed around these constraints. PATCH BANDIT interleaves a lightweight contextual Thompsonsampling placer to efficiently explore placement cells with NES-style zeroth-order texture updates, and grows patch size only when progress stalls, exposing explicit success–versus– area trade-offs. Evaluation is anchored by a strict plain-image suppression criterion; EOT is audited and logged, but never substituted for success. We evaluate PATCH BANDIT across three detector families: YOLOv5 as a one-stage CNN detector, Faster R-CNN as a two-stage CNN detector, and YOLOS as a transformer-based detector. On YOLOv5, PATCH BANDIT achieves 77.5% strict suppression with compact patches (Figure 1); on Faster R-CNN, it reaches 89.7% strict suppression with very small median patch area; and on YOLOS, it achieves 59.1% strict suppression, indicating that the attack remains effective but is less pronounced on the transformer-based detector. A print–capture pilot further indicates that digitally optimized patches can transfer across viewpoints and object instances, repeatedly inducing mis-detections. This paper makes the following contributions: • A score-based black-box detector patch attack that jointly optimizes placement, texture, and size under explicit query budgets by combining contextual Thompson sampling, NES updates, and a progress-triggered growth policy. • A footprint-aware reporting protocol that prioritizes strict plain-image suppression and reports EOT robustness separately, enabling clear success–visibility trade-off analysis (including J = qmed ×amed ). • An empirical evaluation on YOLOv5, Faster R-CNN, and YOLOS showing strong suppression on CNN-based detectors and substantial suppression on a transformer-based detector, plus a print–capture pilot demonstrating transfer across physical viewpoints and objects. 2. RELATED WORK Adversarial Patches and Physical Attacks on Vision Models. Adversarial patches are localized visual triggers that induce model misbehavior when inserted into a scene. Brown et al. introduced universal, printable patches that drive classifiers toward a chosen target under varied viewing conditions [5]. Liu et al. extended this idea to object detectors with DPATCH, degrading both classification and localization in Faster R-CNN and YOLO [6]. Thys et al. demonstrated wearable/held printed patches that reduce person-detection confidence in real-world surveillance settings [7]. Zolfi et al. proposed a translucent lens-mounted sticker that suppresses stop-sign detections without modifying the sign itself [15].
Black-Box and Query-Efficient Adversarial Example Generation. Early score-based black-box attacks estimated gradients via zeroth-order optimization (e.g., ZOO), avoiding substitute models [16]. Ilyas et al. improved query efficiency with Natural Evolution Strategies (NES) [17] and later “Bandits & Priors,” which leverages structured gradient priors through bandit optimization to further reduce queries [9]. Randomized, region-wise methods such as the Square Attack provided another query-efficient alternative for high-dimensional inputs by using structured, localized updates [18]. Joint Optimization of Patch Content and Placement. Patch effectiveness depends on both what is printed and where it is placed. Prior work has treated placement as a decision variable, using RL or black-box optimization to jointly adapt position and appearance under query budgets [11]. Other approaches use evolutionary/annealing-style searches in camouflage-style pipelines (CamoPatch) [19], and recent score-based detector attacks optimize patches at locations via zeroth-order updates (BB-Patch) [20]. Earlier detector work such as DPATCH observed some location invariance but did not perform dense, adaptive placement search [6]. Building on this line, our contextual bandit provides a lightweight, query-aware policy for selecting promising placement cells without full RL training. Stealth, Camouflage, and Printability Constraints. Because effective patches are often visually conspicuous, prior work constrains appearance for camouflage and physical realizability. Camo-style evolutionary methods encourage texturematching while remaining adversarial [19], and Patch of Invisibility uses generative priors to produce natural-looking, printable black-box detector patches [12]. Wearable persondetector attacks similarly highlight the trade-off between attack strength (often high-contrast) and visual plausibility [7]. Evaluation Protocols, EOT, and Physical Robustness. A key challenge is ensuring patches remain effective under realworld transformations (viewpoint, scale, lighting). Athalye et al. introduced Expectation Over Transformation (EOT) to optimize perturbations over a transformation distribution [13]. Eykholt et al. showed that digital gains can collapse in physical settings without rigorous robustness-oriented evaluation [21]. Detector patch work such as DPATCH and Patch of Invisibility similarly tests under diverse, realistic environmental variation, though heavy augmentation can obscure whether the plain image is actually suppressed [6, 12]. Positioning of PATCH BANDIT. We target score-based blackbox detectors and combine three elements that earlier studies explored in isolation: a lightweight contextual bandit selects promising cells under a query budget, NES performs gradientfree pixel updates, and a budget-adaptive size ladder enlarges the patch only when progress stalls. Strict success is recorded on the plain image, while EOT behavior is logged separately; the attack loop records queries, area, and confidence trajectories for reproducible ablations. Table 1 places this design beside prior work. [5], [6], [7] and [15] rely on white-box gradients to train large, universal
Table 1: Representative adversarial patch attacks. Published results are reported for prior methods, while PATCH BANDIT is evaluated under our protocol. WB = white-box; BB = score-only black-box; cls = image classification; det = object detection. Method
Threat Phys. Task Atk Reported effect / protocol
Brown17 [5]
WB
cls
T
98–99% top-1 targeted success (digital); 93% at 1 m (print) Single reusable patch trained with EOT against Inception & VGG.
DPATCH18 [6]
WB
det
B
VOC07 mAP ↓ 65.70% → 0.00% (U); patch-only detec- 40 × 40 px universal patch; cross-model transfer; digitaltions (T) only.
Thys19 [7]
WB
det
U
YOLOv2 person AP ↓ 100% → 25.5%
Zolfi21 [15]
WB
det
U
Stop-sign miss rate 42.3% (physical); AP ↓ 95.17% → Translucent lens sticker; hides a selected class without scene changes. 52.71%
Lapid23 [12]
BB
det
U
AP 23.2% (↓ 43 pp) within 110 k queries
PATCHBANDIT (ours)
BB
det
U
77.5% strict suppression under our protocol; 8.3% median Instance-specific, size-adaptive patch; bandit placer + NES. patch area
Yes
No
Notes
40 × 40 cm printed patch; needs torso placement.
GAN-style universal patch; query-efficient NES; no physical test yet.
Atk: T = Targeted, U = Untargeted, B = Both
overlays that require fixed footprints and long optimization. [12] move to the same score-only interface but use a GAN latent search that lowers Tiny-YOLOv3 average precision to 23 % at a cost of ∼ 1.1×105 queries. In the same setting, PATCH BANDIT suppresses the original top class on 77.5 % of images with a median of 49 calls and an 8.3 % patch area—over three orders of magnitude fewer queries and a smaller footprint. White-box universals remain useful when gradients are revealed or a single reusable sticker is desired, yet that threat model is less representative of commercial detectors. Under the more restrictive but realistic score-only interface, our results show that near-complete suppression is attainable with limited queries and an instance-specific, size-adaptive patch. Experiments with the patch placed on a bottle confirm that the attack transfers across varying viewing distances and angles.
overwrite the corresponding image crop; candidates that spill outside the image are discarded. In digital mode we clamp θ ∈ [0, 1]; in printable mode we clamp to [θmin , θmax ]. Candidate locations and context features. We discretize the image into a G × G grid of feasible top-left locations L. Each location ℓ has a lightweight context vector ϕ(ℓ) ∈ R4 capturing proximity/overlap with the nearest ground-truth box, local texture variance, and whether the cell touches the border. These features bias search toward object-bearing, high-contrast regions that tend to yield stronger suppression [6]. Contextual Thompson sampling for placement. We model the per-location reward as a linear function of context, r = ⟨w⋆ , ϕ(ℓ)⟩ + ξ with ξ ∼ N (0, σ 2 ) and prior w ∼ N (0, λ−1 I). At iteration t, we sample w̃ ∼ N (µt , Σt ) from the posterior and select ℓt = arg maxℓ∈L ⟨w̃, ϕ(ℓ)⟩, then update the posterior with the observed reward. (We use w for bandit weights to avoid overloading the patch symbol θ.) 3. METHODOLOGY NES-style patch update. With the chosen location fixed, we update patch pixels via Natural Evolution Strategies Algorithm 1 summarizes PATCH BANDIT, a query-bounded (NES) [17]. Each iteration samples M perturbations ϵi ∼ black-box patch attack that jointly optimizes (i) where to place N (0, I), evaluates the reward for candidate patches θ(i) = a patch, (ii) the patch texture, and (iii) the patch size. Each Π(θ + σnes ϵi ), and applies a stochastic ascent step to improve iteration selects a candidate location via contextual Thompson θ under the same clamping operator Π(·). sampling, updates patch pixels with NES-style zeroth-order Reward and appearance terms. For the core digital setting optimization, and grows the patch when progress stalls. shown in Alg. 1, the reward is the reduction in the original topThreat model and objective. We consider a score-based H×W ×3 class confidence: r(θ, ℓ) = s0 − c(PASTE (I, θ, ℓ), t). When black-box detector f queried on an RGB image I ∈ [0, 1] , desired, we augment this objective with (i) an EOT-averaged returning detections {(bj , cj , sj )} with confidences sj ∈ [0, 1]. confidence term [13] and (ii) optional appearance/printability For any class c, let c(I, c) = maxj:cj =c sj denote its maxipenalties to expose strength–visibility trade-offs. mum confidence (0 if absent). We define the initial top class Adaptive size ladder. We use a size ladder S = {m1 < · · · < as t = arg maxc c(I, c) with clean score s0 = c(I, t). The 3×m×m m }. Optimization starts at m1 and tracks the best reward so attacker chooses a square patch θ ∈ [0, 1] and a paste L ′ far; if reward fails to improve for τgrow iterations, we upsample location ℓ = (x, y), obtaining I = PASTE(I, θ, ℓ). Success is θ to the next size and rebuild the placement grid. This grows measured by strict suppression of the original top class, using patch area only when needed. only score queries to f (no gradients or parameters). Patch pasting and constraints. Given θ and top-left ℓ, we Query budget and strict success. Each iteration evaluates
Require: Image I, detector f , iterations T , size ladder S = {m1 < · · · < mL }, growth patience τgrow , NES (M, σnes , η), success thresholds (∆min , τabs ) 1: Target class t ← arg max f (I) with score s0 ; init θ ∼ U [0, 1]3×m1 ×m1 , grid L with features ϕ(ℓ) ∈ R4 , bandit posterior (A, b), stall counter 2: for iter = 1 to T do 3: Sample w̃ ∼ N (A−1 b, σ 2 A−1 ); pick ℓ ← arg maxℓ′ ∈L ⟨w̃, ϕ(ℓ′ )⟩ 4: Draw {ϵi }M rewards ri ← s0 − i=1 ∼ N (0, I); evaluate c f (PASTE(I, Π(θ + σnes ϵi ), ℓ)), t P η 5: Update θ ← Π(θ + M i r̃i ϵi ) {r̃i z-scored} 6: r⋆ ← maxi ri ; if (s0 − c⋆ ) ≥ ∆min and c⋆ ≤ τabs : 7: return (θ, ℓ) If no improvement for τgrow iters and m < mL : grow patch via 8: U PSAMPLE and rebuild L 9: Update bandit: A ← A + ϕ(ℓ)ϕ(ℓ)⊤ , b ← b + r⋆ ϕ(ℓ) 10: end for 11: return best (θ, ℓ) found
M patch candidates (and optionally additional transformed views); the run halts when the query cap is reached. We declare success only when the learned patch reduces the original topclass confidence by at least ∆min and pushes it below an absolute cap τabs : (s0 − cplain (θ, ℓ)) ≥ ∆min
∧
cplain (θ, ℓ) ≤ τabs .
(1)
We use ∆min = 0.25 and τabs = 0.10 in all experiments. 4. EVALUATION 4.1. Digital Results Experimental palette. We evaluate 18 controlled variants of PATCH BANDIT that each toggle a single design knob (growth patience, query schedule, context masking, budget stress tests, stealth bias, EOT robustness, and fixed-size controls). Unless stated otherwise, results use the same protocol as the baseline; selected settings are repeated across seeds to assess variability. Effect on headline metrics. Table 2 summarizes how each representative configuration family performs on digital-domain attack metrics: strict success rate, target-score drop, patch area, and number of detector queries. Clear trade-offs emerge across YOLO, Faster R-CNN, and YOLOS. For instance, gp5 matches the baseline’s success rate while roughly halving the median queries on YOLO (1079→529) due to shortened growth patience, with only a small area increase on Faster R-CNN. nocx_strict slightly outperforms the baseline on YOLO despite removing contextual placement, while it is nearly tied on Faster R-CNN. On YOLOS, strict success is lower than on the CNN detectors but remains substantial, with PATCH BANDIT reaching 59.1%. Conversely, fixed160 succeeds using minimal queries but requires significantly larger patches. Robustness and stealth-oriented set-
Strict Success Rate (%)
Algorithm 1 PATCH BANDIT: Contextual Bandit + NES Patch Attack
YOLO:
EOT
GP5
NoCx
Power
FR-CNN:
EOT
GP5
NoCx
Power
YOLOS:
full
NoEOT
NoCx
NoStl
80 60 40 20 0
40
60 80 120 Maximum Patch Size (pixels)
160
Fig. 2: Cumulative success vs. patch size across three detector architectures. Solid: YOLO (one-stage CNN). Dashed: Faster R-CNN (two-stage CNN). Dotted: YOLOS (ViT-backbone transformer). Adaptive variants reach roughly 43–50% by 80 px and 65–70% at 160 px on YOLO, 70–80% by 80 px and 86–87% at 160 px on Faster R-CNN, and 40–42% by 80 px before plateauing near 60% at 160 px on YOLOS.
tings (eot10, stealth-strong) maintain high success with query counts that are broadly comparable to the baseline. Efficiency trade-offs. Given consistent mAP degradation, we now assess the effort per successful attack. Table 2 combines median detector queries and patch area into the joint cost Jfrac = qmed × (amed /100). On YOLO, the non-adaptive fixed160 attains the lowest J by accepting conspicuously large patches; among adaptive variants, gp5 substantially reduces J relative to the baseline by halving queries without enlarging patches. On Faster R-CNN, the baseline achieves the lowest J thanks to very small patches; powerfast and eot10 remain competitive. On YOLOS, gp5 offers the best adaptive efficiency, while fixed160 achieves the lowest overall J at the cost of a larger footprint. Overall, minimizing queries alone is insufficient if patch size remains large, highlighting the value of adaptive growth when visibility matters. Growth dynamics. Figure 2 shows how success accumulates as the patch grows. On YOLO (solid), variants reach 20–30% at 40 px, rise to 45–50% by 80 px, and reach 65–70% at full size. Faster R-CNN (dashed) climbs faster: 50–60% at 40 px, > 70% by 60 px, and plateaus near 85–87% by 120 px. YOLOS (dotted) follows a slower but steady trajectory, reaching about 40–42% by 80 px and plateauing near 60% at 160 px. These trends highlight the benefit of adaptive growth: many images succeed at small or moderate patch sizes, with larger patches used only when necessary. GP5’s steeper early rise reflects reduced growth patience; fixed-size baselines (omitted) capture only terminal outcomes.
Table 2: Digital attack performance and efficiency. Performance columns (blue): Strict success (%), confidence drop, patch area (%), queries. Efficiency columns (orange): queries/success, area/success, joint cost Jfrac = qmed × (amed /100). YOLO (one-stage CNN) Performance
Variant
Strict Dropt Area PATCH BANDIT (ctx-strict) GP5 (fast growth) Nocx_Strict ε-greedy PowerFast (top-swap) Fixed (no adapt) EOT variant Stealth variant
77.5 77.7 78.9 69.8 71.1 79.3 78.4
0.452 0.455 0.406 0.531 0.585 0.416 0.425
Faster R-CNN (two-stage CNN)
Efficiency Q.
Q./s
A./s
Performance
Jfrac Strict Dropt Area Q.
8.32 1079 63.26 10.74 6.794 8.32 529 30.88 10.71 3.307 8.32 1013 58.32 10.55 6.153 8.32 903 58.74 11.92 7.002 14.8 133 8.44 20.82 1.757 8.32 1582 64.33 10.49 6.748 8.32 1035 59.95 10.62 6.367
89.7 90.0 89.6 86.8 79.6 87.6 89.0
0.075 0.080 0.079 0.077 0.087 0.070 0.075
Table 3: Fixed-size patch ablation (digital, contextual placement). Efficiency cost Jfrac = qmed × (amed /100). Detector
Config
Strict (%)
Dropt
Area (%)
Queries
Jfrac
YOLO
method full fixed–160 fixed–80
77.5 71.1 48.2
0.452 0.585 0.810
8.32 14.79 3.70
49.0 6.0 20.0
4.080 0.887 0.740
Faster R-CNN
method full fixed–160 fixed–80
89.7 79.6 66.2
0.075 0.087 0.102
0.92 14.79 3.70
8.0 5.0 5.0
0.074 0.740 0.185
YOLOS
method full fixed–160 fixed–80
59.1 55.4 36.0
0.467 0.777 0.974
8.32 14.79 3.70
290.0 35.0 200.0
24.089 5.178 7.396
YOLOS (ViT transformer)
Efficiency Q./s
A./s
Performance
Jfrac Strict Dropt Area
0.92 177 8.92 1.03 0.092 2.08 155 7.78 2.31 0.180 1.31 353 17.86 1.46 0.261 0.92 177 9.22 1.06 0.098 14.8 111 6.28 18.59 1.167 0.92 249 9.13 1.05 0.096 0.92 188 9.55 1.03 0.098
59.1 60.8 61.3 53.8 55.4 60.2 60.2
0.467 0.558 0.502 0.430 0.777 0.492 0.584
Efficiency Q.
Q./s
A./s
Jfrac
8.32 290 149.95 4.58 24.089 14.79 47.5 32.88 8.13 7.027 8.32 283 157.34 4.56 23.548 8.32 245 167.00 5.20 20.384 14.79 35.0 15.49 14.79 5.178 8.32 288 151.77 4.72 23.964 8.32 297 161.04 5.07 24.713
Table 4: Print–capture pilot outcomes for the physical PATCH BANDIT bottle patch. Patched outcomes report the top YOLOv5 prediction. Condition
Distance
Azimuth
Object
Prediction
Frontal view Tilted view Transfer #1 Transfer #2
40 cm 50 cm 54 cm 54 cm
0◦ 10◦ 0◦ 0◦
Original Original New #1 New #2
chair (0.59) tvmonitor (0.35) bottle (0.41) bottle (0.81)
Outcome Misclassified Misclassified Wrong box / low conf. Wrong box
4.2. Ablation Studies Fixed–size patches. To isolate the value of adaptive growth, we compare PATCH BANDIT to fixed 160 px and 80 px patches. Table 3 shows that adaptive growth generally preserves higher strict success with a smaller footprint than fixed–160, while fixed-size settings reduce Jfrac only by lowering success substantially (fixed–80) or requiring larger patches (fixed–160). Ablation: growth patience and query schedule. Reducing growth patience (gp5) roughly halves YOLO median queries (1079→529) with essentially unchanged strict success (77.5→77.7) and unchanged area (8.32%). By contrast, powerfast yields a smaller query reduction (1079→903) but lowers strict success (77.5→69.8), indicating that shortcut schedules can trade effectiveness for efficiency.
4.3. Physical Pilot Evaluation To assess preliminary physical transfer, we printed a bottle patch optimized entirely in simulation and evaluated it under controlled changes in viewpoint, distance, and object instance. Table 4 summarizes the print–capture outcomes, and Figure 3 shows representative captures. In clean shots, YOLOv5 detected bottle with confidence > 0.90; with the patch, the tested conditions produced misclassification, low-confidence detection, or incorrect localization.
(a) Frontal
(b) Tilted
(c) Transfer #1 (d) Transfer #2
Fig. 3: Representative print–capture results for the physical PATCH BANDIT bottle patch. Quantitative outcomes are reported in Table 4.
5. CONCLUSION PATCH BANDIT combines contextual Thompson-sampling placement, NES zeroth-order updates, and progress-triggered growth into a score-only attack loop. Using a strict plainview suppression criterion and reporting EOT separately, it achieves strong suppression across CNN-based detectors and substantial suppression on a transformer-based detector, while exposing query–footprint trade-offs against fixed-size and heuristic baselines. Compact, budget-aware patches remain a realistic black-box threat, with placement playing a key role in attack efficiency.
Acknowledgments This work was supported in part by a grant from The BMW Group.
6. REFERENCES [1] Joseph Redmon, Santosh Divvala, Ross Girshick, and Ali Farhadi, “You only look once: Unified, real-time object detection,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 779–788. [2] Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun, “Faster r-cnn: Towards real-time object detection with region proposal networks,” Advances in neural information processing systems, vol. 28, 2015. [3] Yuxin Fang, Bencheng Liao, Xinggang Wang, Jiemin Fang, Jiyang Qi, Rui Wu, Jianwei Niu, and Wenyu Liu, “You only look at one sequence: Rethinking transformer in vision through object detection,” Advances in Neural Information Processing Systems, vol. 34, pp. 26183– 26197, 2021. [4] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013. [5] Tom B Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer, “Adversarial patch,” arXiv preprint arXiv:1712.09665, 2017. [6] Xin Liu, Huanrui Yang, Ziwei Liu, Linghao Song, Hai Li, and Yiran Chen, “Dpatch: An adversarial patch attack on object detectors,” preprint arXiv:1806.02299, 2018. [7] Lien Thys, Wiebe Van Ranst, and Toon Goedemé, “Fooling automated surveillance cameras: Adversarial patches to attack person detection,” in CVPR Workshops, 2019. [8] Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin, “Black-box adversarial attacks with limited queries and information,” in International conference on machine learning. PMLR, 2018, pp. 2137–2146. [9] Andrew Ilyas, Logan Engstrom, and Aleksander Madry, “Prior convictions: Black-box adversarial attacks with bandits and priors,” preprint arXiv:1807.07978, 2018. [10] Siyuan Liang, Baoyuan Wu, Yanbo Fan, Xingxing Wei, and Xiaochun Cao, “Parallel rectangle flip attack: A query-based black-box attack against object detection,” arXiv preprint arXiv:2201.08970, 2022. [11] Xingxing Wei, Ying Guo, Jie Yu, and Bo Zhang, “Simultaneously optimizing perturbations and positions for black-box adversarial patch attacks,” IEEE transactions on pattern analysis and machine intelligence, vol. 45, no. 7, pp. 9041–9054, 2022.
[12] Raz Lapid, Eylon Mizrahi, and Moshe Sipper, “Patch of invisibility: Naturalistic physical black-box adversarial attacks on object detectors,” arXiv preprint arXiv:2303.04238, 2023. [13] Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok, “Synthesizing robust adversarial examples,” in International conference on machine learning. PMLR, 2018, pp. 284–293. [14] Chenglin Yang, Adam Kortylewski, Cihang Xie, Yinzhi Cao, and Alan Yuille, “Patchattack: A black-box texturebased attack with reinforcement learning,” in European Conference on Computer Vision. Springer, 2020. [15] Alon Zolfi, Moshe Kravchik, Yuval Elovici, and Asaf Shabtai, “The translucent patch: A physical and universal attack on object detectors,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 15232–15241. [16] Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh, “Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,” in Proceedings of the 10th ACM workshop on artificial intelligence and security, 2017, pp. 15–26. [17] Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin, “Black-box adversarial attacks with limited queries and information,” in ICML, 2018. [18] Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein, “Square attack: a queryefficient black-box adversarial attack via random search,” in European conference on computer vision. Springer, 2020, pp. 484–501. [19] Lifeng Huang, Chengying Gao, Yuyin Zhou, Cihang Xie, Alan L Yuille, Changqing Zou, and Ning Liu, “Universal physical camouflage attacks on object detectors,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 720–729. [20] Satyadwyoom Kumar, Saurabh Gupta, and Arun Balaji Buduru, “Bb-patch: Blackbox adversarial patchattack using zeroth-order optimization,” arXiv preprint arXiv:2405.06049, 2024. [21] Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song, “Robust physical-world attacks on deep learning visual classification,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 1625–1634.